{Secure Infrastructure as code/ K8s / Helm / Docker with Github Action}

Sangam Biradar

Technical Advocate

Tenable

# Github Action

# Github Repository

- Push

- Pull Request ( open , merged )

- issue ( created , closed...)

- schedule ( every 10 pm)

- external event

Workflow

# Github Server

Virtual Machine Instance

- Linux , windows , MacOS with Tools Installed or Docker Container

Job

Step 1

(action)

Step 2

(action)

Step 3

(CMD)

- Linux , windows , MacOS with Tools Installed or Docker Container

Step 2

(action)

Step 3

(CMD)

Step 1

(action)

Job

# Multiple Jobs in Github Action

Job

Virtual Machine Instance

- Linux , windows , MacOS with Tools Installed or Docker Container

Job

Step 1

(action)

Step 2

(action)

Step 3

(CMD)

- Linux , windows , MacOS with Tools Installed or Docker Container

Step 2

(action)

Step 3

(CMD)

Step 1

(action)

Job

Virtual Machine Instance

- Linux , windows , MacOS with Tools Installed or Docker Container

Step 1

(action)

Step 2

(action)

Step 3

(CMD)

# Github Hosted Runner

- Linux , window or MacOs virtual environments with Commonly-used pre-installed software

- Maintained by Github

- You Cannot Customise the hardware configuration

1. create git repo

2. create directory .git/workflow

3. write GitHub Action

# Open Source at

Tenable

https://github.com/accurics/terrascan

Key features

500+ Policies for security best practices
Scanning of Terraform (HCL2)
Scanning of Kubernetes (JSON/YAML), Helm v3, and Kustomize
Scanning of Dockerfiles
Support for AWS, Azure, GCP, Kubernetes, Dockerfile, and GitHub
Integrates with docker image vulnerability scanning for AWS, Azure, GCP,
Harbor container registries.

Terrascan Github Action

Terraform

1.

2.

Kubernetes

3.

Helm Chart

# IAC

4.

Kustomize

5.

Docker

on: [push]

jobs:
  terrascan_job:
    runs-on: ubuntu-latest
    name: terrascan-action-terraform
    steps:
    - name: Checkout repository
      uses: actions/checkout@v2
    - name: Scan Terraform 
      id: terrascan
      uses: accurics/terrascan-action@main
      with:
        iac_type: 'terraform'
        iac_version: 'v14'
        policy_type: 'aws'
        only_warn: true
        sarif_upload: true
        iac_dir: 'test_dirs/fail/'
       
    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v1
      with:
          sarif_file: terrascan.sarif

# Terraform

# Kubernetes

on: [push]

jobs:
  terrascan_job:
    runs-on: ubuntu-latest
    name: terrascan-action-terraform
    steps:
    - name: Checkout repository
      uses: actions/checkout@v2
    - name: Scan Terraform 
      id: terrascan
      uses: accurics/terrascan-action@main
      with:
        iac_type: 'k8s'
        iac_version: 'v1'
        policy_type: 'k8s'
        only_warn: true
        sarif_upload: true
        iac_dir: 'test_dirs/k8s/'
       
    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v1
      with:
          sarif_file: terrascan.sarif

# Custom Policies

on: [push]

jobs:
  terrascan-docker:
    runs-on: ubuntu-latest
    name: terrascan-action-docker
    steps:
    - name: Checkout repository
      uses: actions/checkout@v2
    - name: Scan docker custom
      id: terrascan-k8s
      uses: accurics/terrascan-action@main
      with:
        iac_type: 'docker'
        iac_version: 'v1'
        policy_type: 'docker'
        only_warn: true
        sarif_upload: true
        #non_recursive:
        iac_dir: 'test_dirs/custom-policies/'
        policy_path: 'test_dirs/custom-policies/'
        #skip_rules:
        #config_path:
        
    - name: Upload SARIF file
      uses: github/codeql-action/upload-sarif@v1
      with:
        sarif_file: terrascan.sarif


   Input: iac_type
   Description: Required  IaC type (helm, k8s, kustomize, terraform).
 
   Input: iac_dir
   Description: Path to a directory containing one or more IaC files. Default   ".".


   Input: iac_version
   Description: IaC version (helm: v3, k8s: v1, kustomize: v3, terraform: v12, v14).
   : 

   Input: non_recursive
   Description: Do not scan directories and modules recursively
   : 

   Input: policy_path
   Description: Policy path directory for custom policies.
   : 

   Input: policy_type
   Description: Policy type (all, aws, azure, gcp, github, k8s). Default   all.
   : 

   Input: skip_rules
   Description: One or more rules to skip while scanning (example: "ruleID1,ruleID2").
   : 

   Input: config_path
   Description: Config file path.
   : 

   Input: sarif_upload
   Description: If this variable is included, a sarif file named terrascan.sarif will be generated with the results of the scan.
   : 

   Input: verbose
   Description: If this variable is included, the scan will show violations with additional details (Rule Name/ID, Resource Name/Type, Violation Category)
   : 

   Input: iac_version
   Description: IaC version (helm: v3, k8s: v1, kustomize: v3, terraform: v12, v14).
   : 

   Input: find_vulnerabilities
   Description: If provided, the scan output will display vulnerabilities for Docker images present in the IaC files.
   : 

   Input: scm_token
   Description: If provided, Terrascan will use the provided access token to retrieve private repositories from your source code management system.
   : 

   Input: webhook_url
   Description: If this variable is included, the scan results and the normalized config will be sent to the specified URL. If the variable is set along with config_path, then configs from the config path will be ignored.
   : 

   Input: webhook_token
   Description: Included this variable if the notification webhook url requires authentication.
   :

package accurics

{{.prefix}}{{.name}}{{.suffix}}[expose.id]{
	expose := input.docker_expose[_]
	is_string(expose.config)
    config := expose.config
    checkPort(config)
}

{{.prefix}}{{.name}}{{.suffix}}[expose.id] {
    expose := input.docker_expose[_]
    is_array(expose.config)
    config := expose.config
    checkPortList(config)
}

checkPort(config) {
    contains(config, "22")
}
checkPortList(config) {
    contains(config[_], "22")
}

package accurics

{{.prefix}}{{.name}}{{.suffix}}[apt.id]{
	apt := input.docker_expose[_]
	conval := apt.config
    port := split(conval, "/")
    containsPortOutOfRange(port)
}
containsPortOutOfRange(ports) {
	some i
	port := ports[i]
	to_number(port) > 65535
}

# Docker Expose

FROM ubuntu:latest
LABEL MAINTAINER "sangam"

ENV SECRET AKIGG23244GN2344GHG
ENV GITLAB_API_ID gig32oig3bgi34gb43gb43uigb43i 

WORKDIR /app

ADD app /app
COPY README.md /app/README.md
ADD code /tmp/code
RUN apt-get udpate
EXPOSE 65539
RUN  apt-get update && apt-get install -y htop

CMD ["/bin/bash", "/app/entrypoint.sh"]